Repository navigation
Security dependencies: jwt, kin-openapi, Common v0.4.26 - #1
Merged
Merged
Conversation
inkly
commented
Sep 22, 2026
inkly
commented
Collaborator
- CI and releases build with the latest Go 1.26 patch; the module requires Go 1.26.8.
- jwt, kin-openapi and Common v0.4.26.
- The message bus client sends the internal secret.
- A test proves a valid request still gets through auth and validation; the docs no longer say loopback is trusted.
- The unused npm SDK scaffolding is gone.
setup-go used go-version-file: go.mod, which installs exactly the go directive (1.26.0), so released binaries missed the standard library security fixes shipped in later 1.26 patch releases. Ask for 1.26 with check-latest so CI always picks the newest patch.
Common v0.4.26 requires Go 1.26.8, so the go directive moves from 1.26.0 to 1.26.8. It also pulls golang-jwt/jwt/v4 up to v4.5.2, which fixes GO-2025-3553 (excessive memory allocation while parsing headers) and GO-2024-3250 (ParseWithClaims error handling). This service did not use anything Common removed (jwt.JWT, file.AddFile), so no code changes.
v0.117.0 is affected by several openapi3filter advisories that the v2 request validator reaches from the HTTP server: - GO-2025-3533 / GHSA-wq9g-9vfc-cfq9: unbounded decompression of request bodies (fixed in v0.131.0) - GHSA-mmfr-pmjx-hw9w: nil-pointer panic on a malformed multipart body (fixed in v0.141.0) - GO-2026-6112 / GHSA-jpcw-4wr7-c3vq: nil-pointer panic on a content parameter without a schema (fixed in v0.144.0) GHSA-r277-6w6q-xmqw (ValidationHandler fails open with the no-op authentication function) is also cleared by the bump. This service does not use ValidationHandler: it passes NoopAuthenticationFunc to the validator on purpose, because the JWT middleware registered before it already does the authentication. deepmap/oapi-codegen v1.12.4's echo middleware still compiles against v0.149.0, so it stays; codegen/ is not regenerated.
Checks that the JWT middleware answers before the OpenAPI validator, and that the validator still finds routes and checks parameters against the spec. Written for the kin-openapi bump; it passes on both v0.117.0 and v0.149.0.
The message bus is about to require the per-boot internal secret on loopback calls. Without it, the bus would refuse this service's event type registration at startup and the events it publishes when a user saves a config. The generated message bus client now adds the secret through Common's InternalRequestEditor, which reads it from the runtime path on each request and only attaches it to loopback URLs. A test checks that the request reaching the bus carries a secret that IsInternalRequest accepts.
The README and the comment on the route test client still said the JWT middleware skips any request from 127.0.0.1 or ::1. Since v0.4.25 it skips only a loopback request that also carries the per-boot internal secret (external.IsInternalRequest). The README now says so, and that it covers /v2/users too.
TestV2AuthThenValidation only had requests that stop at the JWT middleware or at the OpenAPI validator, so it would still pass if the validator refused every request. It now has a real event store behind the rig and checks that a valid GET /v2/users/events reaches its handler (200), both with a user token and from loopback with the internal secret. It also pins the two halves of the internal check: the secret from a LAN address and loopback without the secret both get 401.
package.json and tsconfig.json built a TypeScript SDK from the OpenAPI spec for IceWhale's npm scope. The workflow that published it was removed with the release pipeline rework, and nothing in the build, the workflows or goreleaser reads either file. The .gitignore entries that only served them (node_modules/, .package-lock.json and a second dist/) go too; the first dist/ stays for goreleaser.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.